Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity
54,459 Commits 25 Branches 192 Tags
release/v6.1
Commit Graph
720 Commits
Author SHA1 Message Date
Jin Cheng 42d38ed969 fix(bt/bluedroid): fixed OOB read dring mSBC sync word check 2026-09-15 11:45:34 +08:00
Zhi Wei Jian 5eb72d5eab feat(ble/bluedroid): reject LE re-pairing that weakens an existing bond 
Add smp_repairing_is_allowed() behind BT_BLE_SMP_HARDENED_REPAIRING so a
peer cannot replace an existing bond with one that has less MITM
protection, no Secure Connections, or a shorter key. Compare a preceding
Security Request against the pairing command AuthReq, not the
association-model result, and always allow first pairing.

A refusal keeps the stored bond. Pairing-failure erase is split by link
role: default is erase as Central and keep as Peripheral.

Closes BLERP (NDSS 2026) V3, V4 and V6.


(cherry picked from commit 88ea45be73)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-04 11:04:00 +08:00
Zhi Wei Jian 5ed6b8dc0c fix(ble/bluedroid): harden LE bond handling across encryption 
Keep the existing bond until the new pairing is encrypted, and on encryption
failure drop the link instead of clearing keys. Recovering from a peer that
really deleted the bond is opt-in through BT_BLE_SMP_UNBOND_ON_KEY_MISSING.

Closes BLERP (NDSS 2026) V5, and stops an unauthenticated Pairing Request
from dropping the stored keys (V2 exploitation).


(cherry picked from commit f864615d7d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-09-04 11:03:59 +08:00
Wang Meng Yang 530c113ccf Merge branch 'fix/bt_memory_v6.1' into 'release/v6.1' 
fix(bt_memory): Reduce memory usage in transfer (v6.1)

See merge request espressif/esp-idf!52275
 2026-09-04 07:49:41 +08:00
hejiaxin 79221f020d fix(bt_avrcp): size some AVRC command buffers 2026-09-03 10:40:52 +08:00
hejiaxin 28add9e24b fix(bt_l2cap): size L2CAP ERTM S-frame & RX SDU buffer 2026-09-03 10:40:52 +08:00
hejiaxin 560cc8ccf2 fix(bt_sdp): size SDP TX buffers 2026-09-03 10:40:52 +08:00
hejiaxin e5632732d8 fix(bt_rfcomm): size RFCOMM TX buffers by peer MTU 2026-09-03 10:40:52 +08:00
hejiaxin 693a830f3e fix(bt_hid): size HID TX buffers to report length 2026-09-03 10:40:52 +08:00
zhiweijian bc400f224b feat(ble/bluedroid): Support PAWR connection event 2026-08-31 19:50:00 +08:00
Jiang Jiang Jian ae42d2cf67 Merge branch 'bugfix/fix_bluedroid_find_info_format_mismatch_v6.1' into 'release/v6.1' 
fix(ble/bluedroid): restore find info PDU stop on UUID format mismatch (6.1)

See merge request espressif/esp-idf!52081
 2026-08-31 11:46:57 +08:00
Jiang Jiang Jian 5ca2597430 Merge branch 'fix/ble_hidd_remove_ccc_gating_v6.1' into 'release/v6.1' 
fix(esp_hid/bluedroid): remove app-layer CCC gating in HID device (6.1)

See merge request espressif/esp-idf!51008
 2026-08-31 11:13:50 +08:00
Jiang Jiang Jian e8bc6e4385 Merge branch 'feat/support_bluedroid_le_coc_and_eatt_v6.1' into 'release/v6.1' 
feat(ble/bluedroid): Support bluedroid LE COC and EATT features (6.1)

See merge request espressif/esp-idf!50716
 2026-08-31 11:07:59 +08:00
hejiaxin 21270aea18 fix(bt_obex): fix some bugs in bluedroid obex 
- fix goepc wait state switch
- fix psm unbind's mismatch
- fix some resources leak
- fix goep connection's incorrect ternimation when congesting
- Add some NULL ptr check
 2026-08-28 10:09:29 +08:00
Wang Meng Yang 95d4f21533 Merge branch 'fix/aireview_critical_v6.1' into 'release/v6.1' 
fix: Fix some critical bugs in classic bt (v6.1)

See merge request espressif/esp-idf!51288
 2026-08-28 09:18:04 +08:00
Wang Meng Yang 5abb8c7386 Merge branch 'bugfix/a2dp_sink_nego_sbc_v6.1' into 'release/v6.1' 
fix(bt): do not cap AVDTP Discover results by local SEP count (v6.1)

See merge request espressif/esp-idf!51750
 2026-08-28 08:39:37 +08:00
Wang Meng Yang 8036c800a2 Merge branch 'change/refactor_hidh_datapath_v6.1' into 'release/v6.1' 
Change/refactor hidh datapath[backport v6.1]

See merge request espressif/esp-idf!51278
 2026-08-28 08:31:57 +08:00
hejiaxin e907e90f08 fix(bt_stack): Fix some critical bugs in classic_bt stack 
related: obex, smp, pbap, sdp, rfcomm, stack_dm

- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
 2026-08-27 19:05:45 +08:00
yangfeng 93e93fa58b fix(bt): do not cap AVDTP Discover results by local SEP count 
- Closes https://github.com/espressif/esp-idf/issues/18848
 2026-08-27 17:55:38 +08:00
liqigan 7052617d11 change(bt/bluedroid): Refactored HCI ACL datapath 2026-08-27 17:51:25 +08:00
Wang Meng Yang 0b976b4458 Merge branch 'fix/bluedroid_aireview_v6.1' into 'release/v6.1' 
Fix/bluedroid aireview (v6.1)

See merge request espressif/esp-idf!51294
 2026-08-27 17:46:38 +08:00
Wang Meng Yang 3f090c0eb0 Merge branch 'bugfix/bredr_critical_bugs_v6.1' into 'release/v6.1' 
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v6.1)

See merge request espressif/esp-idf!51078
 2026-08-27 17:44:25 +08:00
Wang Meng Yang 4e8e22ac63 Merge branch 'feat/bt_in_psram_v6.1' into 'release/v6.1' 
feat(bluedroid): Add config to place btu and hci task stack in psram (v6.1)

See merge request espressif/esp-idf!51489
 2026-08-27 17:38:13 +08:00
Zhang Hai Peng 82a626220e fix(ble/bluedroid): restore find info PDU stop on UUID format mismatch 
Restore GATT_NO_RESOURCES when sequential attributes have differing UUID
sizes so gatts_process_find_info() stops building the response PDU.


(cherry picked from commit 196cb39545)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-08-26 14:43:57 +08:00
yangfeng 5ef217c63a fix(bluedroid): Fix the compilation issue of BCM_STRNCPY_S 2026-08-13 19:15:56 +08:00
hejiaxin 0515e0da6b feat(bluedroid): Add config to place btu and hci task stack in psram 
- Also adjust the osi_thread_stop implementation.
 2026-08-04 14:55:27 +08:00
Jin Cheng b5d3256213 fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-07-29 17:30:20 +08:00
hejiaxin bb47816fb1 fix(bt): Fix some bug in stm_sco.c 
- Memory safety
- State machine & logic integrity
- Resource leaks
- Edge cases check
 2026-07-29 17:30:20 +08:00
Jin Cheng a16219df1c fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:41:31 +08:00
Zhang Hai Peng b3c4cfb0fb fix(ble/bluedroid): track ext scan state for rand addr check 
Update inq_var.state only after btsnd_hcic_ble_ext_scan_enable succeeds.
Clear BTM_BLE_SCANNING on explicit stop and controller scan timeout.


(cherry picked from commit 23519567e4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
 2026-07-21 10:53:28 +08:00
linruihao 9d4cf4d70c fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:13 +08:00
Jiang Jiang Jian 2dd51a0e75 Merge branch 'bugfix/avrc_ca_attr_id_check_v6.1' into 'release/v6.1' 
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v6.1)

See merge request espressif/esp-idf!50549
 2026-07-17 10:31:02 +08:00
Jiang Jiang Jian 4fe6db39ca Merge branch 'bugfix/bug_bounty_av_v6.1' into 'release/v6.1' 
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v6.1)

See merge request espressif/esp-idf!50476
 2026-07-16 18:57:38 +08:00
yangfeng 5af3a74a45 fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-16 14:27:53 +08:00
Jiang Jiang Jian 6cb467a433 Merge branch 'bugfix/fix_bluedroid_read_multi_v6.1' into 'release/v6.1' 
fix(ble/bluedroid): fix GATT Read Multiple response handling (6.1)

See merge request espressif/esp-idf!50710
 2026-07-16 11:59:11 +08:00
yangfeng 24369a6f81 fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC 
Closes SEC-1186
 2026-07-16 11:30:38 +08:00
yangfeng e8108fefe1 fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq 
Closes SEC-1187
 2026-07-16 11:30:38 +08:00
Zhi Wei Jian 9a05b3f471 feat(ble/bluedroid): Support bluedroid dual identity 
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:14:16 +08:00
Zhi Wei Jian ab712f8d82 fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders 
(cherry picked from commit abbf001120)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:38 +08:00
Zhi Wei Jian 39d036aee0 fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure 
(cherry picked from commit 4fd1ebb4a9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:38 +08:00
Zhi Wei Jian 627cd55958 docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked 
(cherry picked from commit 34b59d30ae)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:37 +08:00
Zhi Wei Jian 43016c8501 fix(ble/bluedroid): fix direct-connect cleanup and adv bounds 
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:37 +08:00
Zhi Wei Jian e8c38d0c53 fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device 
(cherry picked from commit 93ab11d564)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:37 +08:00
Zhi Wei Jian 0a3025632f fix(ble/bluedroid): validate SMP pair-fail reason and OOB device 
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:36 +08:00
Zhi Wei Jian 5481cd12e6 fix(ble/bluedroid): route ATT indication-conf timeout separately 
(cherry picked from commit 6c3267ee84)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:36 +08:00
Zhi Wei Jian 416e6e145b fix(ble/bluedroid): validate ATT PDU sizes 
(cherry picked from commit bb00b9817d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:36 +08:00
Zhi Wei Jian b29e17fb9d fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback 
(cherry picked from commit 37562af0ea)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:35 +08:00
Zhi Wei Jian 5054bfa330 fix(ble/bluedroid): fix GATT long read and Service Changed CCC 
(cherry picked from commit 4ce692ac0c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:35 +08:00
Zhi Wei Jian a637a5a200 fix(ble/bluedroid): validate GATT client discovery handles 
(cherry picked from commit ac35ae6f2d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:35 +08:00
Zhi Wei Jian a0916503a7 fix(ble/bluedroid): cap Read By Type length and free failed service decl 
(cherry picked from commit 27ff0cf8c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
 2026-07-14 12:04:34 +08:00